What is Important Data Under Chinese Law?

Important Data (重要数据) is a category of data subject to enhanced protection in China because its compromise could affect national security or wider public interests. For businesses operating apps, SaaS platforms, connected products or industrial systems, identifying this data is an essential part of planning how information is collected, used, shared and transferred overseas.

This guide builds on AppInChina’s overview of China’s data types and classification system, focusing on Important Data and the obligations associated with it.

What Is China’s Data Security Law?

China’s Data Security Law (中华人民共和国数据安全法), effective from 1 September 2021, establishes the national framework for protecting data. 

• Article 2 applies to processing within China and provides for liability for certain harmful processing overseas. 
• Article 3 covers information recorded electronically or otherwise. 
• Article 21 establishes classification and grading, with enhanced protection for Important Data and stricter management of National Core Data. 

Businesses must read this framework alongside the Cybersecurity Law, the Personal Information Protection Law (PIPL), applicable sector rules and the Network Data Security Management Regulations, effective from 1 January 2025. These instruments address different aspects of the same data environment: the information being processed, the systems supporting it and the consequences of sharing it.

How Does Chinese Law Define Important Data?

Article 62(4) of the Network Data Security Management Regulations defines Important Data as “data in a specific field, group or region or with a certain precision and scale, which, once tampered with, destroyed, divulged, illegally obtained or illegally used, may directly endanger national security, economic operation, social stability, public health and security.” 

In practical terms, classification requires considering what the data could reveal and what could happen if it were compromised. A company should therefore distinguish commercially confidential information from information that meets the applicable Important Data criteria. For example, an internal sales forecast should not be classified as Important Data solely because a competitor would find it valuable.

The CAC’s April 2025 guidance directs businesses to Appendix G of GB/T 43697-2024, Data Security Technology Rules for Data Classification and Grading, when identifying Important Data. This recommended national standard provides technical guidance; companies must also apply relevant legal requirements and sector rules.

Is Important Data the Same as Personal Information?

No. These classifications address different risks and can overlap.

Category	What it concerns	Legal reference
Personal Information	Information relating to an identified or identifiable individual, excluding anonymised information.	PIPL, Article 4
Sensitive Personal Information	Personal information whose disclosure or misuse could harm dignity or personal or property safety, including health, biometric, financial-account and location information, and information about children under 14.	PIPL, Article 28
Important Data	Data meeting the applicable criteria concerning national security and wider public harm.	Network Data Security Management Regulations, Article 62(4)

The first two categories are defined in the Personal Information Protection Law. A dataset may require protection under both PIPL and the Important Data rules. Equally, concluding that data is not Important Data does not remove any PIPL obligations.

Anonymisation also needs careful treatment. Articles 4 and 73 of PIPL exclude information that can no longer identify an individual and cannot be restored. Encryption or removing names does not necessarily achieve this. Even genuinely anonymised information needs a separate Important Data assessment: removing individual identifiers does not necessarily remove the wider risks described above.

Article 21 of the Data Security Law stipulates that National Core Data is a separate, more tightly controlled category relating to national security, economic lifelines, major livelihood interests and major public interests.

What Are Examples of Important Data in China?

A good industry to look at for examples of important data is the automotive industry. Article 3 of the Provisions on the Management of Automotive Data Security (Trial) includes:

• Geographic information and personnel or vehicle flows around specified sensitive locations.
• Vehicle-flow and logistics data reflecting economic operations.
• Vehicle-charging-network operational data.
• Images or video captured outside vehicles containing faces or number plates.
• Personal information involving more than 100,000 individuals.

For a SaaS provider, the practical implication is to review the datasets and business functions it supports. Describing a product as “enterprise software” does not, by itself, resolve its data classification.

How Can Companies Identify and Declare Important Data?

Start with a data inventory. Record what each dataset contains, where it originates, its geographic coverage and scale, how it is used, where it is stored and who can access it. Then compare that inventory with applicable regulatory catalogues, published criteria and notices received from the relevant authorities.

Article 2 of the Provisions on Promoting and Regulating Cross-Border Data Flows requires identification and declaration under applicable rules. It also states that data not notified or publicly designated as Important Data need not be submitted for an export security assessment as Important Data. This does not remove the identification obligation or other applicable compliance requirements. 

A published designation matters even without an individual notice. Keep a record of the criteria checked, the classification reasoning and any regulatory correspondence, and revisit the assessment when the dataset or business changes.

Sector procedures may require a filing. For example, Article 12 of the MIIT Data Security Management Measures requires covered businesses to file their Important Data and Core Data catalogues with the local industry regulator. The filing describes the data and its processing arrangements; it does not include the underlying data itself. 

What Obligations Apply When Processing Important Data?

The Network Data Security Management Regulations establish the following duties:

Obligation	Requirement	Article
Governance	Appoint a qualified data-security lead from management and establish a security-management body.	30
Annual assessment	Assess processing annually and report to the competent provincial or higher authority.	33
Sharing and outsourcing	Assess risks before provision, entrusted processing or joint processing, except when fulfilling statutory duties or obligations.	31
Contracts and records	Agree security obligations, supervise recipients and retain provision/outsourcing records for at least three years.	12
Corporate changes	Report disposal arrangements and recipients when mergers, division, dissolution or bankruptcy may affect Important Data security.	32

The annual report describes processing and safeguards without including the underlying data. 

These controls should be coordinated with the business’s MLPS compliance programme. In implementation, use the data inventory to connect each protected dataset with its hosting environment, access permissions, suppliers and responsible staff.

Must Important Data Be Stored in Mainland China?

Article 39 of the Cybersecurity Law requires Critical Information Infrastructure operators to store Personal Information and Important Data collected or generated through their Mainland operations domestically. Necessary overseas provision is subject to the applicable security-assessment requirements. 

Storage requirements should therefore be checked separately from export approval. For a cloud deployment, map both the database location and the locations from which employees, suppliers or group companies can access its contents.

Can Important Data Be Transferred Outside China?

Yes, where the applicable requirements are met.  For further context, see AppInChina’s guide to transferring data out of China.

What Are the Penalties for Non-Compliance?

Under the Data Security Law:

Violation	Possible company fines
Failure to fulfil specified security duties: Article 45	RMB 50,000–500,000; RMB 500,000–2 million for refusal to correct or serious consequences.
Unlawful Important Data exports: Article 46	RMB 100,000–1 million; RMB 1–10 million in serious cases.

Responsible personnel can also be fined. Serious cases can lead to business suspension or licence revocation.

How Can AppInChina Help?

As part of AppInChina’s data compliance services, we can help by:

• Reviewing your data collection, processing and overseas-access arrangements to assess the applicable requirements.
• Explaining whether your proposed transfers require a security assessment or qualify for another compliance route.
• Preparing and coordinating the documentation required for the relevant assessment or filing.

Contact us to book a free compliance assessment and discuss the requirements for your business.